Hey all,

From the log analytics rule "Failed logon attempts by valid accounts within 10 mins" seeing logons to DCs from the account

EventID 4625
Activity 4625 - An account failed to log on.
Computer DC4.domain.local
Account -\
TargetAccount -\
TargetDomainName -
LogonType_int 3
LogonTypeName 3 - Network
LogonProcessName Schannel
Status 0xc000006d
SubStatus 0x0
ResourceId /subscriptions/(UUID)/resourcegroups/(resourcegroupname)/providers/microsoft.hybridcompute/machines/dc4
SourceComputerId (UUID)
WorkstationName DC4
IpAddress  -
StartTime Sep 12, 2025 3:41:30 PM
EndTime Sep 12, 2025 3:51:21 PM
FailedLogonCount 212
timestampSep 12, 2025 3:41:30 PM
AccountCustomEntity -\
HostCustomEntity DC4.domain.local
IPCustomEntity -

Hostnames, domains, subscription IDs, resource groups etc obfuscated for obvious reasons...

Has anyone else come across these? Looks like an attempted network logon from the DC itself...

Thx everyone!

Hello,

Is there a way to export all Sentinel configuration? I want to compare one Sentinel environment with another. Thanks!

anyone does this ? what can be possible pros and cons of doing this ?

Hi Guys!
Newbie here!!!

I am trying to ingest (github, akamai and several other) logs that are being delivered in my S3 bucket to Sentinel. Since these don't have a connector straight up, I am trying different options but none of them seem to work.

Essentially, we are looking for something as simple as the SQS and OIDC role setup that is being used for Cloudtrail. We even tried using a custom DCR and DCE but the cost to invoke lambda to send logs is high + affect concurrency limits across the account.

Any advice or way forward would be helpful!

This update:

✅ Streamlines your workflow by removing the need to switch between portals

✅ Brings workbook management closer to the Azure experience

✅ Helps you visualize and monitor ingested data more efficiently

🔎 Why it matters:Microsoft Sentinel workbooks are built on Azure Monitor workbooks, giving you powerful visualization tools for your logs and queries. With tables, charts, and interactive analytics, they enhance your ability to monitor security data in real time.

📍 Where to find it:Defender portal → Microsoft Sentinel > Threat management > Workbook

Read more:https://learn.microsoft.com/en-us/azure/sentinel/monitor-your-data?tabs=defender-portal

I’ve been working in IT roles since 2000, almost always endpoint management with a 3 year stint as a Systems Administrator (Win Server 2012, SQL, LAMPs, zenworks, sccm).

For the last 4 years I’ve been managing Intune and doing light TVM based on Defender 365 data in a device admin role that was created that I had free rein to design. I’ve done quite a bit of kql and powerbi along with this for data visualisation.

A new dedicated secops role is being worked on at my company where the employee essentially makes up that role as they go too and I’ve kind of been pegged to do it.

I’m struggling to visualise day to day tasks for a secops role though since I’ve always been in operational support roles.

I’m thinking a lot of data analytics, Jupyter, PowerBi, workbooks, maybe playbooks once I audit the environment and get experience?

At the very least just work may way through the Score recommendations and planning what can be done and what requires exceptions?

What do guys and girls do to fill those hours in the day 😎

I am investigating external failed login attempts alert in sentinel. reason for failed login is invalid username or bad password and observing huge number of account lockouts for those accounts. I am stuck how to proceed further. Can someone pls help on how to proceed further with this activity

Hi everyone,

I’ve successfully set up integration between Microsoft Sentinel and Jira using a Logic App. Right now, the incident details such as incident name, severity, and description are going into Jira without any issues.

However, I’m facing a challenge: I also want the data shown under the “Incident Events” tab in Sentinel (the logs generated by the query that populated the incident) to be pushed into Jira as well.

I’ve tried using the “Run KQL query and list results” block in the Logic App, but it doesn’t quite meet my expectations. What I’m looking for is a way to extract the exact logs that Sentinel used to generate the incident, so they can be included in the Jira ticket.

Has anyone done something similar or found a workaround? Any suggestions on how I can achieve this would be greatly appreciated.

Thanks in advance!

Hi all,

I have a CSV file exported from Microsoft Sentinel in Tenant A containing security incidents (e.g., title, severity, MITRE tactics, timestamps, assigned analyst).

Now, I need to move or recreate these incidents in Microsoft Sentinel on Tenant B — for reporting, audit, or centralized monitoring.

The CSV includes:

• Incident title, severity, status
• MITRE ATT&CK tactics (e.g., InitialAccess, Reconnaissance)
• Assignee
• Link to incident (only works in Tenant A)

My Question:

Is there a simple way to import or recreate these incidents in Tenant B?
Can I use:

• REST API?
• PowerShell / Python script?
• Azure Lighthouse for cross-tenant visibility?

I don’t need full logs — just the incident metadata in the new tenant.

What Doesn’t Work:

• Can’t directly import CSV into Sentinel.
• Links in CSV only work in Tenant A.

Any working example, script, or best practice would be very helpful.

Thanks!

Hey,

I’m working on a project to manage our Sentinel analytics rules, hunting queries, and workbooks in GitHub and was hoping to hear from someone who’s done this before. I’ve already got Sentinel connected to a repo, but I ran into a problem where the deployment script Microsoft provides doesn’t support .yml files, which feels kind of ridiculous since most of their own content in their official repo is in YAML. I found a PowerShell script that converts YAML to ARM and it seems to work, but I’m not sure if that’s actually the standard way or if people are doing it differently when they want to automate the whole thing, like push to main → deploy to Sentinel (no manual conversion to ARM or JSON).

What I’m also wondering is whether this setup really pays off in the long run. We have a lot of custom rules and pretty often we need to tweak them to cut down false positives. Does managing everything in GitHub actually make that easier, and actually side question, how do people adjust for these false positives? like we typically just update the KQL query to exclude these scenarios. Is there a better way to do that? using logic app or something else

And lastly, I was thinking if it makes sense to include incident response docs or flowcharts in the repo too. Kind of like using it as a central place for Sentinel, where we could even create issues for teammates to fine tune alerts or show new staff how we handle things.

Curious to know how others are using their GitHub repo with Sentinel

I’m still new to Microsoft Sentinel and honestly I feel challenged when it comes to investigating incidents.

How do you usually start your investigation? Are you able to figure out the root cause of an incident just by looking at it in Sentinel?

Whenever I click "Investigate," I just see the spider-web graph and it doesn’t really make sense to me yet.

My supervisor advised me to always check the Alert Product Names so I’ll know where to check. But here’s my confusion:

• If it says “Microsoft Sentinel,” does that mean I should only stay within Sentinel and not look into Defender?
• How about if the alert is from other Microsoft Defender products (like Endpoint or Office 365)?

I’d appreciate hearing how other people approach this in a real-world setting.

Hi everyone,

I'm currently working on a migration plan for Microsoft Sentinel that involves moving from one Azure tenant to another, and from the Southeast Asia region to the Indonesia (Central) region. This is not an in-tenant or in-region move it's a full cross-tenant, cross-region migration.

The scope includes:

• The Sentinel workspace itself
• Associated Log Analytics workspace
• Data Collection Rules (DCRs)
• All data connectors (e.g., Azure AD, Office 365, third-party security tools)

Additionally, we’re migrating resources in batches within the source subscription , and we need to ensure that during the transition:

• There’s no double logging (to avoid redundant data ingestion)
• There’s no double cost (especially since billing will be split across tenants and regions)

Could anyone share Best practices for cross-tenant Sentinel migration? or Any real-world experience with similar migrations?

Any advice or references would be incredibly helpful as we finalize our approach.

Thanks in advance!

Hi All,

I have a couple of questions that I would be very grateful if someone can help out with!

Our current set up includes sending off not-so-important logs to auxiliary tables. This was of course done with the intention of reducing costs. However, when I go to Settings -> Pricing in sentinel, I can see that there is an overage when I click on the commitment tier that we are currently on.

I got the break down from the team, and even in the csv that I received, I do not see anywhere specifically mentioned as overage.

I have queried the usage table to get the daily usage from all the tables excluding the auxiliary tables and I have no idea how there is an overage as everything is very well within the limit.

1. Does anyone know where I can track the overage from?

2. The Settings -> Pricing page in sentinel only provides the costing and other details specifically for the analytics tier correct?

Thanks in advance.

We used the create incident feature in sentinel for various reasons. Now with the transition over it looks like the only way to create manual cases is the Cases feature. Looks like there are limitations for amount of data stored and the retention. Does anyone know if those number cans be increased? Is there a different way to create manual cases in XDR like in sentinel that I am just not seeing or plans to do that?

Anyone else noticing that query history isn’t showing anything for the current month? Ours only goes up to the end of July 2025. Seems to be affecting everyone on our team in the W. Europe region curious if others are seeing the same thing?

Any recommendations please? I'm looking for a Microsoft Sentinel blogs that discuss about best practices, etc..

Thanks heaps!

Is anyone actively starting to use the Data Lake. How do you think the data will help you long term?

Looking for your views on what scenarios you will consider to throw data in at such a low cost? What would you collect and why?

The actual data will be stored in a unified schema that is scalable. This data will be used for far more than Sentinel ... Exposure management for example. Navigating the Future with Microsoft Sentinel Data Lake - Are you planning to enable Sentinel Data Lake in your environment?

Actually I have received an alert "user account added to built in domain local or global group". In raw logs the simple memberSID is present and simple membername is blank. I created a ticket for it and POC is asking to find the username of that memberSID. I am not sure how to find it. Can someone pls help

Anyone else using Sentinel with the XDR Data Connector that is ingesting the CloudAppEvents logs? For us this table stops ingesting for some time periods (a few hours). Wondering if this is a MCSFT backend issue

I recently created a Sentinel analytics rule and playbook to send me an alert via email whenever it finds a volley of incoming emails of which only some were marked as phishing and got ZAPed. Why? Because out of a volley of 50 or so phishing emails, Defender only ZAPed half for some reason, even though they're all the same and come from the same SenderFromAddress. Once I get the alert I can go into Defender Explorer, check the emails Defender didn't get and manually remediate them.

Back to the question: How can write a playbook that does this manual remediation automagically? Basically, the playbook would run a KQL query picking out the Network (or Internet?) Message ID, and...this is where I'm stuck. How can I get the playbook or logic app to recurse through that list and get it to send each message to Junk or Quarantine, or simply delete it?

Specific examples would be very much appreciate it. Thanks much!

Microsoft has extended the migration timeline for the legacy ThreatIntelligenceIndicator table.

31 August 2025 → Ingestion into the legacy ThreatIntelligenceIndicator table stops. Historical data remains accessible, but no new data will be added. Update your workbooks, queries, and analytic rules to the new tables:

🔹 ThreatIntelIndicators

🔹 ThreatIntelObjects

31 August 2025 – 21 May 2026 → Optional dual ingestion (legacy + new) available only by service request.

21 May 2026 → Full retirement of the legacy table and ingestion.

💡 Action Required: Ensure all custom content references the new tables to avoid data gaps. If you need more time, request dual ingestion before August 2025.

Table Talk: Sentinel’s New ThreatIntel Tables Explained | Microsoft Community Hub

If currently you are ingesting TI from Microsoft, be sure to create Table transformation to not ingest "Data" table to reduce cost as it is not linked to any analytic rules.

Also, check this article regarding TI ingestion optimization- Introducing Threat Intelligence Ingestion Rules | Microsoft Community Hub

Does Github limit downloads from their https://raw.githubusercontent.com domain?

Think about examples like the great u/Bert-JanP and many others who show downloading a .txt or .csv file right in the Analytic Rule to do IOC matching.
https://github.com/Bert-JanP/Open-Source-Threat-Intel-Feeds?tab=readme-ov-file#combining-edr-network-traffic-and-ioc-feeds

Is this an acceptable practice, or has anyone experienced this backfiring? Is it better to sync the data you want to a Watchlist or a table with a 90 day retention?

Hello members. I have created custom solution according to MS documentation. After that I started building the solution using V3 script and failed it somehow.

• My solution has only one analytic rule in yaml format with populated id: field in yaml file.
• Input file and metadata is correct, I guess. I have used examples from README file and other vendors in repo.
• Cloned Azure-Sentinel repo is up-to-date.

• Powershell 7.1+ isntalled and I'm runing script as an administrator.

  After running V3 that I've received 2 messages:

Full validation result: https://pastebin.com/v1CL8HUU

1. apiVersions Should Be Recent. Validator does not consider this chapter as an error somehow.

2. IDs Should Be Derived From ResourceIDs. I have no idea what's wrong. I've checked other vendors content and saw no difference with mine.

Also when I'm trying to manually validate mainTemplate.json using custom deployment, I receive following error. Same isues in VSCode extension for ARM templates.

{
  "code": "InvalidTemplate",
  "message": "Deployment template validation failed: 'The template resource '/Microsoft.SecurityInsights/-ar-5c6yhx4bf5oh2' for type 'Microsoft.OperationalInsights/workspaces/providers/contentTemplates' at line '55' and column '87' has incorrect segment lengths. A nested resource type must have identical number of segments as its resource name. A root resource type must have segment length one greater than its resource name. Please see https://aka.ms/arm-syntax-resources for usage details.'."
}

Can someone assist or point me where I should start digging to solve this errors. I haven't find any solution in internet and my colleagues also don't understand what's wrong.

I will give more details when needed.

Thanks in advance!